@faable/auth-sdk 2.8.27 → 2.9.1

package/README.md

@@ -242,6 +242,26 @@ const members = await api.listTeamMembers({ query: "alice" }).first();
 const isMember = await api.isUserMemberOfTeam("user_xxx", "team_xxx");
 ```
 
+### Roles and permissions
+
+A role grants permissions of your APIs. Assign it to a user at the account level and their tokens for an API with `rbac` enabled carry those permissions (team roles grant none).
+
+```ts
+const role = await api.roleCreate({ name: "support" });
+await api.roleAddPermissions(role.id, {
+  permissions: [{ api: "api_xxx", value: "tickets:write" }],
+});
+
+await api.userAssignRoles("user_xxx", { roles: [role.id] });
+const roles = await api.userRoles("user_xxx");
+const permissions = await api.userPermissions("user_xxx"); // with the role that grants each
+
+await api.userRemoveRoles("user_xxx", { roles: [role.id] });
+await api.roleRemovePermissions(role.id, {
+  permissions: [{ api: "api_xxx", value: "tickets:write" }],
+});
+```
+
 ### Connections
 
 ```ts
@@ -325,6 +345,37 @@ export default async function handler(req, res) {
 
 `WebhookEvent`, `WebhookEventType`, `WebhookEventOf<"user.created">` and `WebhookPayload<"team.member.added">` are generated from the auth OpenAPI, like every other type.
 
+## Protecting your API
+
+Verify the access tokens your API receives and check their permissions:
+
+```ts
+import {
+  AccessTokenError,
+  bearerToken,
+  requirePermissions,
+  verifyAccessToken,
+} from "@faable/auth-sdk";
+
+export default async function handler(req, res) {
+  try {
+    const claims = await verifyAccessToken(bearerToken(req.headers.authorization), {
+      domain: process.env.FAABLEAUTH_DOMAIN!, // https://<tenant>.auth.faable.link
+      audience: "https://api.example.com", // your Api's identifier
+    });
+    requirePermissions(claims, "tickets:write");
+    // … claims.sub is the user (or the client, for machine tokens)
+  } catch (e) {
+    if (e instanceof AccessTokenError) return res.status(e.status).json({ error: e.reason });
+    throw e;
+  }
+}
+```
+
+- `verifyAccessToken` checks the signature against the tenant JWKS (fetched once and cached), `iss`, `aud` and `exp`. It throws `AccessTokenError` with `status` 401.
+- `requirePermissions` throws `AccessTokenError` `insufficient_scope` with `status` 403 and `missing`; `hasPermissions` returns a boolean. Both require **all** the permissions passed.
+- The `permissions` claim needs the Api's `token_dialect` to be `access_token_authz`. With `rbac` on, a user token carries the permissions the client **requested** that the user's roles grant, so request them as scopes.
+
 ## Types
 
 All response shapes are generated from the OpenAPI spec and re-exported from the package root:

package/dist/api/generated-client.d.ts

@@ -1155,6 +1155,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1209,6 +1210,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1264,6 +1266,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -1320,6 +1323,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1358,6 +1362,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1399,6 +1404,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             token_dialect: "access_token" | "access_token_authz";
             token_lifetime: number;
             enforce_policies: boolean;
+            rbac: boolean;
             allow_offline_access: boolean;
             consent_options?: {
                 claim: string;
@@ -1455,6 +1461,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         token_dialect: "access_token" | "access_token_authz";
         token_lifetime: number;
         enforce_policies: boolean;
+        rbac: boolean;
         allow_offline_access: boolean;
         consent_options?: {
             claim: string;
@@ -5356,6 +5363,31 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             ok: boolean;
         } | null;
     }>;
+    /**
+     * `POST /role/{role_id}/permissions` — operationId: `role/add_permissions`
+     *
+     * Add permissions to a Role
+     *
+     * Grants Api permissions to a Role. Each must be in the catalog of an Api of this tenant. Permissions the Role already has are kept. Tokens issued from now on (refreshes included) carry them; tokens already issued are unchanged. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_permission` (400) — A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleAddPermissions(role_id: string, data: OpBody<"role/add_permissions">): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
     /**
      * `POST /role/{role_id}/users` — operationId: `role/assign_users`
      *
@@ -5392,6 +5424,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5419,6 +5455,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5447,6 +5487,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -5476,6 +5520,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5487,6 +5535,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5501,6 +5553,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             id: string;
             name: string;
             description: string;
+            permissions: {
+                api: string;
+                value: string;
+            }[];
             account: string;
             metadata: {
                 [key: string]: unknown;
@@ -5509,6 +5565,76 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `GET /role/{role_id}/permissions` — operationId: `role/permissions`
+     *
+     * List the permissions of a Role
+     *
+     * Lists the Api permissions the Role grants, each with its Api. A user gets them in tokens for an Api with `rbac` enabled when the Role is assigned to them at the account level.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    rolePermissions(role_id: string): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
+    /**
+     * `DELETE /role/{role_id}/permissions` — operationId: `role/remove_permissions`
+     *
+     * Remove permissions from a Role
+     *
+     * Revokes Api permissions from a Role. Permissions the Role does not have are ignored. Tokens already issued keep them until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemovePermissions(role_id: string, data: OpBody<"role/remove_permissions">): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+    }[]>;
+    /**
+     * `DELETE /role/{role_id}/users` — operationId: `role/remove_users`
+     *
+     * Remove Users from Role
+     *
+     * Revokes an account-level role from users. Their next tokens (refreshes included) no longer carry its permissions; tokens already issued keep them until they expire. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemoveUsers(role_id: string, data: OpBody<"role/remove_users">): Promise<{
+        removed_from_role: string[];
+        not_in_role: string[];
+    }>;
     /**
      * `POST /role/{role_id}` — operationId: `role/update`
      *
@@ -5530,6 +5656,10 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         id: string;
         name: string;
         description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
         account: string;
         metadata: {
             [key: string]: unknown;
@@ -6521,6 +6651,39 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             updatedAt?: string | undefined;
         }>>;
     };
+    /**
+     * `POST /user/{user_id}/roles` — operationId: `user/assign_roles`
+     *
+     * Assign roles to a User
+     *
+     * Assigns account-level roles to the User and returns all of their roles. Roles the User already has are kept. Their next tokens (refreshes included) carry the new permissions. Leaves an entry in the tenant's log. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userAssignRoles(user_id: string, data: OpBody<"user/assign_roles">): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user` — operationId: `user/create`
      *
@@ -7351,6 +7514,66 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         ticket_id: string;
         channel: "email" | "sms" | "whatsapp" | "factor";
     }>;
+    /**
+     * `GET /user/{user_id}/permissions` — operationId: `user/permissions`
+     *
+     * List a User's permissions
+     *
+     * Lists the Api permissions the User holds through their account-level roles, with the roles that grant each one. For an Api with `rbac` enabled, these are exactly what the User's tokens for that Api carry in `permissions`.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userPermissions(user_id: string): Promise<{
+        api: string;
+        api_identifier: string;
+        api_name: string;
+        value: string;
+        description?: string | undefined;
+        roles: {
+            id: string;
+            name: string;
+        }[];
+    }[]>;
+    /**
+     * `DELETE /user/{user_id}/roles` — operationId: `user/remove_roles`
+     *
+     * Remove roles from a User
+     *
+     * Removes account-level roles from the User and returns the ones left. Roles the User does not have are ignored. Tokens already issued keep the permissions until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRemoveRoles(user_id: string, data: OpBody<"user/remove_roles">): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
      *
@@ -7391,6 +7614,38 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         status: "revoked" | "already_used";
         id: string;
     }>;
+    /**
+     * `GET /user/{user_id}/roles` — operationId: `user/roles`
+     *
+     * List a User's roles
+     *
+     * Lists the roles assigned to the User at the account level, by name. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRoles(user_id: string): Promise<{
+        id: string;
+        name: string;
+        description: string;
+        permissions: {
+            api: string;
+            value: string;
+        }[];
+        account: string;
+        metadata: {
+            [key: string]: unknown;
+        };
+        createdAt: string;
+        updatedAt?: string | undefined;
+    }[]>;
     /**
      * `POST /user/{user_id}` — operationId: `user/update`
      *

package/dist/api/generated-client.js

@@ -1810,6 +1810,28 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("domain", domain);
         return this.fetcher.post(`/organization/${organization_id}/domain/${domain}/verify`, {});
     }
+    /**
+     * `POST /role/{role_id}/permissions` — operationId: `role/add_permissions`
+     *
+     * Add permissions to a Role
+     *
+     * Grants Api permissions to a Role. Each must be in the catalog of an Api of this tenant. Permissions the Role already has are kept. Tokens issued from now on (refreshes included) carry them; tokens already issued are unchanged. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_permission` (400) — A permission is not in the catalog of its Api, or the Api is not in this account. `details.permissions` lists the ones refused.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleAddPermissions(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.post(`/role/${role_id}/permissions`, data);
+    }
     /**
      * `POST /role/{role_id}/users` — operationId: `role/assign_users`
      *
@@ -1909,6 +1931,70 @@ export class GeneratedFaableAuthApi extends FaableApi {
     roleList(params) {
         return this.paginator({ url: `/role`, params });
     }
+    /**
+     * `GET /role/{role_id}/permissions` — operationId: `role/permissions`
+     *
+     * List the permissions of a Role
+     *
+     * Lists the Api permissions the Role grants, each with its Api. A user gets them in tokens for an Api with `rbac` enabled when the Role is assigned to them at the account level.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    rolePermissions(role_id) {
+        requireId("role_id", role_id);
+        return this.fetcher.get(`/role/${role_id}/permissions`);
+    }
+    /**
+     * `DELETE /role/{role_id}/permissions` — operationId: `role/remove_permissions`
+     *
+     * Remove permissions from a Role
+     *
+     * Revokes Api permissions from a Role. Permissions the Role does not have are ignored. Tokens already issued keep them until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemovePermissions(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.request({ method: "DELETE", url: `/role/${role_id}/permissions`, data });
+    }
+    /**
+     * `DELETE /role/{role_id}/users` — operationId: `role/remove_users`
+     *
+     * Remove Users from Role
+     *
+     * Revokes an account-level role from users. Their next tokens (refreshes included) no longer carry its permissions; tokens already issued keep them until they expire. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    roleRemoveUsers(role_id, data) {
+        requireId("role_id", role_id);
+        return this.fetcher.request({ method: "DELETE", url: `/role/${role_id}/users`, data });
+    }
     /**
      * `POST /role/{role_id}` — operationId: `role/update`
      *
@@ -2481,6 +2567,28 @@ export class GeneratedFaableAuthApi extends FaableApi {
     teammemberList(params) {
         return this.paginator({ url: `/teammember`, params });
     }
+    /**
+     * `POST /user/{user_id}/roles` — operationId: `user/assign_roles`
+     *
+     * Assign roles to a User
+     *
+     * Assigns account-level roles to the User and returns all of their roles. Roles the User already has are kept. Their next tokens (refreshes included) carry the new permissions. Leaves an entry in the tenant's log. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `invalid_role` (400) — The role belongs to another account.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userAssignRoles(user_id, data) {
+        requireId("user_id", user_id);
+        return this.fetcher.post(`/user/${user_id}/roles`, data);
+    }
     /**
      * `POST /user` — operationId: `user/create`
      *
@@ -2707,6 +2815,48 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("user_id", user_id);
         return this.fetcher.post(`/user/${user_id}/password-setup`, data);
     }
+    /**
+     * `GET /user/{user_id}/permissions` — operationId: `user/permissions`
+     *
+     * List a User's permissions
+     *
+     * Lists the Api permissions the User holds through their account-level roles, with the roles that grant each one. For an Api with `rbac` enabled, these are exactly what the User's tokens for that Api carry in `permissions`.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userPermissions(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/permissions`);
+    }
+    /**
+     * `DELETE /user/{user_id}/roles` — operationId: `user/remove_roles`
+     *
+     * Remove roles from a User
+     *
+     * Removes account-level roles from the User and returns the ones left. Roles the User does not have are ignored. Tokens already issued keep the permissions until they expire; refreshes drop them. Leaves an entry in the tenant's log.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRemoveRoles(user_id, data) {
+        requireId("user_id", user_id);
+        return this.fetcher.request({ method: "DELETE", url: `/user/${user_id}/roles`, data });
+    }
     /**
      * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
      *
@@ -2749,6 +2899,27 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("ticket_id", ticket_id);
         return this.fetcher.post(`/user/${user_id}/tickets/${ticket_id}/revoke`, {});
     }
+    /**
+     * `GET /user/{user_id}/roles` — operationId: `user/roles`
+     *
+     * List a User's roles
+     *
+     * Lists the roles assigned to the User at the account level, by name. Account-level roles are what grant Api permissions to a user (in tokens for an Api with `rbac` enabled). Team roles are separate: they live on the team membership and grant no permissions.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `not_found` (404) — The resource does not exist in this account.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userRoles(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/roles`);
+    }
     /**
      * `POST /user/{user_id}` — operationId: `user/update`
      *